Which is an example of a cross-site scripting (XSS) attack?

Cross-Site Scripting (XSS) is a type of web security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. This can lead to session hijacking, credential theft, or redirection to malicious sites. XSS attacks typically exploit vulnerabilities in web applications that fail to properly sanitize user input.

Here’s an analysis of the given options:

A. SELECT username FROM accounts WHERE username='admin';-- ' AND password='password';

This is an example ofSQL Injection (SQLi)rather than XSS. It manipulates SQL queries to bypass authentication, not execute JavaScript in a user’s browser.

B. <img src="http://badfile/nothere" onerror=alert(document.cookie);>

This is a classicXSS attack.

It uses an tag with a non-existent src attribute.

The onerror event triggers when the image fails to load, executing alert(document.cookie);, which can expose session cookies.

This method is commonly used forstealing cookies or executing arbitrary scripts.

C. SELECT username FROM accounts WHERE username='XSS' ' AND password='alert("http://badurl.com")';

This isneither a valid SQL injection nor a valid XSS attack.

The syntax suggests an incorrect SQL query rather than JavaScript execution in a browser.

D. <IMG SRC="xss.png">

This isnot a valid XSS attackunless there is an additional event handler like onload, onerror, or onmouseover executing JavaScript.

By itself, it just loads an image and does not execute any malicious script.

Thus,Option Bis the correct answer as it represents a real-world XSS attack technique.

References:

OWASP XSS Guide: https://owasp.org/www-community/attacks/xss/

Fortinet XSS Protection Documentation: https://docs.fortinet.com/